300-440 Exam Dumps : Designing and Implementing Cloud Connectivity (ENCC)

The architecture model that establishes internet-based connectivity between on-premises networks and AWS cloud resources is the one that establishes an iPsec VPN tunnel with Internet Key Exchange (IKE) for secure key negotiation and encrypted data transmission. This model is also known as the VPN CloudHub model12. It allows multiple remote sites to connect to the same virtual private gateway in AWS, creating a hub-and-spoke topology1. The VPN CloudHub model provides the following benefits12:

• It enables secure communication between remote sites and AWS over the public internet, using encryption and authentication protocols such as IPsec and IKE.
• It supports dynamic routing protocols such as BGP, which can automatically adjust the routing tables based on the availability and performance of the VPN tunnels.
• It allows for redundancy and load balancing across multiple VPN tunnels, increasing the reliability and throughput of the connectivity.
• It simplifies the management and configuration of the VPN connections, as each remote site only needs to establish one VPN tunnel to the virtual private gateway in AWS, rather than multiple tunnels to different VPCs or regions.

The other options are not correct because they do not establish internet-based connectivity between on-premises networks and AWS cloud resources. Option B relies on AWS Elastic Load Balancing (ELB) for traffic distribution and uses SSL/TLS encryption for secure data transmission. However, ELB is a service that distributes incoming traffic across multiple targets within a VPC, not across different networks3. Option C employs AWS Direct Connect for a dedicated network connection and uses private IP addresses for secure communication. However, AWS Direct Connect is a service that establishes a private connection between on-premises networks and AWS, bypassing the public internet4. Option D uses Amazon CloudFront for caching and distributing content globally and uses HTTPS for secure data transfer. However, Amazon CloudFront is a service that delivers static and dynamic web content to end users, not to on-premises networks5.

References:

• 1: Designing and Implementing Cloud Connectivity (ENCC, Track 1 of 5)
• 2: Cisco ASA Site-to-Site VPN
• 3: What Is Elastic Load Balancing?
• 4: What is AWS Direct Connect?

Step 1 = Create the groups of interest. Step 2 = Configure the topology. Step 3 = Create the application-aware routing policy. Step 4 = Apply the application-aware routing policy to a specific VPN and sites.

The process of configuring an application-aware routing policy in Cisco vManage involves several steps12.

• Create the groups of interest: This is the first step where you define the applications or groups that the policy will affect1.
• Configure the topology: This involves setting up the network topology that the policy will operate within1.
• Create the application-aware routing policy: After setting up the groups and topology, you then create the application-aware routing policy. This policy tracks network and path characteristics of the data plane tunnels between Cisco SD-WAN devices and uses the collected information to compute optimal paths for data traffic31.
• Apply the application-aware routing policy to a specific VPN and sites: Finally, the created policy is applied to a specific VPN and sites. This allows the policy to affect the desired network traffic1.

References :=

• Designing and Implementing Cloud Connectivity (ENCC) v1.0
• Learning Plan: Designing and Implementing Cloud Connectivity v1.0 (ENCC 300-440)
• Information About Application-Aware Routing - Cisco
• Configuring Application-Aware Routing (AAR) Policies | NetworkAcademy.io
• Policies Configuration Guide, Cisco IOS XE SD-WAN Releases 16.11, 16.12

 A fully meshed topology with SD-WAN technology using dynamic routing and prioritized traffic for QoS meets the network architecture requirements of the company. A fully meshed topology provides high availability by eliminating single points of failure and allowing multiple paths between branch offices. SD-WAN technology enables multihoming by supporting multiple transport options, such as MPLS, internet, LTE, etc. SD-WAN also provides QoS by applying policies to prioritize traffic based on application, user, or network conditions. Dynamic routing allows the SD-WAN solution to adapt to changing network conditions and optimize the path selection for each traffic type. A fully meshed topology with SD-WAN technology can also support specific routing needs, such as segment routing, policy-based routing, or application-aware routing. References:

• Designing and Implementing Cloud Connectivity (ENCC) v1.0
• [Cisco SD-WAN Design Guide]
• [Cisco SD-WAN Configuration Guide]